Tietosuojavaltuutetun toimisto (Finland) - 6689/186/20: Difference between revisions

Revision as of 22:24, 10 February 2021

Tietosuojavaltuutetun toimisto - 6689/186/20

Authority:	Tietosuojavaltuutetun toimisto (Finland)
Jurisdiction:	Finland
Relevant Law:	Article 5(1) GDPR Article 6 GDPR Article 10 GDPR Article 12 GDPR Article 25 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	15.01.2021
Published:	02.02.2021
Fine:	None
Parties:	Helsingin kaupunki (City of Helsinki)
National Case Number/Name:	6689/186/20
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Finnish
Original Source:	Finlex (in FI)
Initial Contributor:	V
The Finnish DPA ordered the data processor, the City of Helsinki, to align its data processing practice related to the criminal background check of applicants seeking to volunteer as a child support person.
English Summary

Facts

Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject has given consent to the data controller to obtain the applicant's criminal records.
Dispute

Lawfulness of processing of personal data related to the investigation of criminal background of applicants seeking to volunteer as a support person for children and/or youth.
Holding

The Deputy Data Protection Ombudsman ordered the City of Helsinki, the data controller, to correct its data processing practice in accordance with the GDPR.
Comment

This decision does not assess the activities of the police in relation to the processing of personal data, in particular the transfer of data. In accordance with the inspection plan of the Office of the Data Protection Ombudsman (10253/164/20), the disclosure of personal data to the authorities in individual cases will be subject to inspection in 2021. The decision will therefore be sent to the Police Board and the Helsinki Police Department for information. The decision will be sent to the Ministry of Social Affairs and Health for information for a possible assessment of the timeliness of the legislation, as the decision concerns the interpretation of Section 20 of the Act on the Rights and Status of Social Welfare Clients. The decision will also be sent to the Finnish Non-Discrimination Ombudsman for information upon request. The decision is not yet final.
Further Resources

Share blogs or news articles here!
English Machine Translation of the Decision

The decision below is a machine translation of the Finnish original. Please refer to the Finnish original for more details.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fi" lang="fi"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><title> Data Protection Supervisor 15.1.2020 - FINLEX ® </title><meta name="description" content="Finlex ® is a public and free Internet service for legal material owned by the Ministry of Justice." /><meta name="DC.Title" content="FINLEX ® - Tietosuojavaltuutettu 15.1.2020" /><meta name="DC.Language" content="fi" /><meta name="DC.Identifier" content="/fi/viranomaiset/tsv/2020/20200703" /><meta name="DC.Publisher" content="Oikeusministeriö" /><meta name="DC.Subject" content="Rikostaustan selvittämiseen liittyvien henkilötietojen käsittely lasten tukihenkilötoiminnan yhteydessä" /><link rel="Shortcut Icon" href="/favicon.ico" type="image/x-icon" /><link rel="apple-touch-icon" href="/assets/img/touch-icon.png" type="image/png" /><link rel="image_src" href="/assets/img/logo-144x118.png" /><link rel="stylesheet" href="/assets/css/fonts.css" type="text/css" media="all" /><link rel="stylesheet" href="/assets/css/screen.css" type="text/css" media="screen, projection" /><link rel="stylesheet" href="/assets/css/finlex.css" type="text/css" media="screen, projection" /><link rel="stylesheet" href="/assets/css/print.css" type="text/css" media="print" /><!--[if lt IE 8]> <link href="/assets/css/ie.css" media="screen" rel="stylesheet" type="text/css" /><![endif]--><script type="text/javascript" src="/assets/js/mootools-core-1.4.1.js"></script><script type="text/javascript" src="/assets/js/finlex.js"></script><link rel="search" type="application/opensearchdescription+xml" title="Finlex ® Search everything" href="/fi/opensearch/kaikki/" /><link rel="search" type="application/opensearchdescription+xml" title="Finlex ® Up-to-date legislation search" href="/fi/opensearch/ajantasa/" /><link rel="search" type="application/opensearchdescription+xml" title="Finlex ® Case Law Search" href="/fi/opensearch/oikeus/" /><link rel="search" type="application/opensearchdescription+xml" title="Finlex ® Authorities Search" href="/fi/opensearch/viranomaiset/" /></head><body id="lang-fi"><div id="header"><div id="header-content" class="container"><h1> <a href="/fi/" title="Finlex"><span>Finlex ®</span></a></h1><div id="lang" title="Select language"><ul><li class="choose-lang-fi"> <a href="/fi/">In Finnish</a></li><li class="choose-lang-sv"> <a href="/sv/">In Swedish</a></li><li class="choose-lang-en"> <a href="/en/">In English</a></li></ul></div><div class="siirry"> <a class="skip" href="#skip">Skip to content</a></div><div id="locationBar0" title="You are here:"> <span class="skip">You are here:</span> <a class="home" href="/fi/">Finlex</a> › <a href="/fi/viranomaiset/">Authorities</a> › <a href="/fi/viranomaiset/tsv/">Data Protection Commissioner</a> › <a href="../2020/" title="Data Protection Supervisor 2020">2020</a> › <span title="Data Protection Supervisor 15.1.2020">15.1.2020</span></div><div id="navi-container"><ul id="navi"><li> <a href="/fi/">front page</a></li><li> <a href="/fi/laki/" accesskey="l">Legislation</a></li><li> <a href="/fi/oikeus/" accesskey="o">Case law</a></li><li class="selected"> <a href="/fi/viranomaiset/" accesskey="v">Authorities</a></li><li> <a href="/fi/sopimukset/" accesskey="s">Government contracts</a></li><li> <a href="/fi/esitykset/" accesskey="e">Government proposals</a></li><li> <a href="http://julkaisut.finlex.fi" accesskey="j">Proceedings</a></li></ul></div></div><div id="section-header"><div id="search"><h3 class="title search"> Search the material </h3><form action="/fi/viranomaiset/tsv/haku/" method="get"><div class="search"><input type="hidden" name="search[type]" value="pika" /><input title="Keyword..." type="text" name="search[pika]" class="search-phrase" value="" accesskey="h" /></div><input type="submit" name="submit" class="submit" value="Search ›" /><p class="search-example"> Search the text for eg personal * and give up *. As a Keyword Break *. Also try <a href="/fi/viranomaiset/tsv/haku/">Advanced Search</a> . See <a href="/fi/ohjeet">instructions</a> .</p></form></div><div class="info"><div class="container"><div id="breadcrumbs"> <span class="skip">You are here:</span> <a class="home" href="/fi/">Finlex</a> › <a href="/fi/viranomaiset/">Authorities</a> › <a href="/fi/viranomaiset/tsv/">Data Protection Commissioner</a> › <a href="../2020/" title="Data Protection Supervisor 2020">2020</a> › <span title="Data Protection Supervisor 15.1.2020">15.1.2020</span> </div></div></div></div></div><div id="main"><div id="main-content"><div id="document-header"><h2 id="skip" title="FINLEX ® - Data Protection Officer 15.1.2020"> 1/15/2020</h2></div><div id="document"><div id="oikeus-tsv"><h3 class="asiasanat"> Processing of personal data related to the investigation of criminal background in connection with the activities of child support staff</h3><table class="metadata"><tr><th style="vertical-align:text-top"> Keywords:</th><td> Criminal background<br/> Personal information<br/> Data minimization<br/> Support staff activities<br/></td></tr><tr><th> Legal basis:</th><td> Decision under the EU General Data Protection Regulation</td></tr><tr><th> Diary number:</th><td> 6689/186/20</td></tr></table><h4 id="OT1"> THING</h4><p> The data subject has sent a request for action to the Office of the Data Protection Commissioner concerning the processing of his or her personal data by the City of Helsinki's social and health services. The processing of personal data has taken place in connection with the application for a voluntary child / young person support person. The data subject asks the Data Protection Officer to comment on the lawfulness of the processing of the personal data in question.</p><h5 id="OT2"> Statement received from the data subject</h5><p> The registrant has applied to the City of Helsinki as a voluntary child / young person support person. The registrant has attended an interview with the social counselor for support personnel on 20 August 2020. In connection with the interview, he has given a power of attorney to request information from the police. Based on what has been said, he has understood that the power of attorney gives consent to apply for an extract from the criminal record. The interviewer had said that in addition to the criminal record extract, there will be information about home alarms.</p><p> The data subject has exchanged correspondence on the matter by e-mail with the representatives of the data controller. Part of the correspondence has been delivered to the Office of the Data Protection Officer after a request for clarification has been sent to the controller. The messages relevant to the case are set out below. Consultation of the data controller on this correspondence is manifestly unnecessary within the meaning of section 34 (2) (5) of the Administrative Procedure Act (434/2003), as the data controller's representatives have themselves been parties to the communication.</p><p> <strong>On 27 August 202020,</strong> the registrant received a message from the registrar's representative, which belonged to e.g. as follows: “Your police information arrived yesterday and I was surprised when we received several investigation reports from you. You didn’t mention these old stuff in the interview, even though you’re certainly in all the roles involved. Do you still want to talk about these with me in more detail on the phone? ”</p><p> <strong>On 28 August 202020, the registrant</strong> has received a message from the registrar's representative stating e.g. next “I can show those investigation notices to you the next time we meet and then put them in the shredder. The issues mentioned in the announcements have nothing to do with acting as a support person, and I have no need to address past issues if they have been addressed by you. Indeed, we have effective co-operation with the police and with the power of attorney you signed, the police will provide us with copies of the notification of all the cases of that person. This is a very important part of the selection process for us, when we assess who is suitable for our activities and who is not. ”</p><p> <strong>On 2 September 202020,</strong> the registrant received a message from the registrar's representative in response to his inquiry: “You are right that the more familiar law regarding volunteers working with children is the law on determining the criminal background of volunteers working with children. However, with regard to volunteers working independently with children, it has been seen as important to find out the background more comprehensively in the case of special support clients under the City of Helsinki's Child Welfare and Social Welfare Act. An adult serving as a surrogate family, foster family, support family, or support person is often in contact with a child who has been traumatized or has special needs. For this reason, it is particularly important for the city, as a responsible actor, to ensure that it is safe for the child to be with an adult volunteer trained for the task. Sometimes there are situations where a criminal record extract for a volunteer working with children does not provide sufficiently comprehensive information, but adults with, for example, a criminal background that does not appear in that criminal record extract are involved. For this reason, applicants for support activities are asked for consent to request information from the police authority in accordance with section 20 (1) of the Act on the Status and Rights of Social Welfare Clients. In particular, the consent refers to the last sentence of the paragraph, which refers to the verification of the information provided to the authority.</p><p> Naturally, information about a person from the police is not retained, and information obtained during the coaching process is processed with the volunteer being coached. All other documents held by the city concerning the person are, of course, available to the person concerned, and a meeting with the relevant employee can be arranged for this purpose. As a result of your contact, we were still particularly critical of the consent form in use, as well as of the legal reference (mentioned above), I wonder if the wording of the form with the Legal Service a few years ago is too imprecise. I will therefore contact the City of Helsinki's Legal Services unit to clarify whether any changes have taken place in the interpretation of the article since the form was drawn up or whether the wording needs to be clarified. ”</p><p> <strong>On 24/09/2020, the</strong> registrant sent a message to the registrar's representative: I was looking at these documents I photographed in your office today. Your request for information from the police concerns "information in the police information system", without a time limit. Photographed documents are investigating three reported, that are recorded in the years 2015, 2016 and 2018, and all of which I am the injured party. These have been considered by you to be essential information within the meaning of the Social Welfare Act for support person activities, where a non-professional volunteer spends time twice a month with a child / young person. For comparison purposes, for example, a criminal record extract from a volunteer adult friend has been assessed as a sufficient explanation for a young person / child in a challenging life situation for similar work at the Helsinki Mission. Also, the SOS crisis phone, which I have just started training, and which is being called by children and young people in a very challenging situation, has considered a volunteer criminal record extract to be a sufficient explanation. Even with the power of attorney I have described and signed, I have not given my consent to the retrieval of these investigative notices, but only to the criminal and criminal records. It is good that I finally got an answer to my information request questions when we met today, although I did not receive copies of these documents from you on several occasions, nor did I explain why 13 pages could not be copied, but could only describe them on my phone, then put them in a locked privacy box. . You mentioned at today's meeting the "end of our common journey" and I will make sure that by this you meant that my election to the autumn support staff training has been canceled, and so I will not have access to the training starting in October? If so, could I still obtain a justification for this withdrawal of choice? I was of the opinion that this assessment of the appropriateness of the process has not been personified by you either, but has been able to deal with it. ”</p><p> <strong>On 25 September 202020, the data subject</strong> has received a message from the data controller's representative: “In the case of support staff, the matter is still pending in so far as a report is prepared for our Data Protection Officer in our sub-unit on the basis of information requests. As the forerunner of the sub-unit, I do not consider it possible to participate in the activities, at least during this process. You can return to the matter once the process is in the decision, if it is still relevant for you. I do not see it as appropriate to conduct coaching with a person who has not yet received the written explanation he or she has requested and is being processed by the City of Helsinki in his or her request for clarification. Irrespective of the person, it is necessary to complete such processes first. ”</p><p> <strong>On 4 November 202020,</strong> the registrant received a message from the registrar's representative: “After your selection for support staff activities, we have reassessed your suitability for support staff activities for children and young people in the City of Helsinki. Based on the selection criteria, you are not suitable for this activity, ie we do not invite you to support person coaching. The reason for this is that, at the meeting on 24 September 2020, you said that you would not be willing to continue to find out the background information (police information) that we require in our operations. An adult as a support person is often dealing with a traumatized or special needs child. For this reason, it is particularly important for the city, as a responsible actor (service provider and supervisor), to ensure that it is safe for the child to be with a trained adult volunteer. As for support staff, this is where your process ends.</p><h5 id="OT3"> Statement received from the controller</h5><p> The EDPS Office has requested clarification from the controller. The report was received on 9.12.2020. The report has been issued by the City of Helsinki, Social and Health Care Division, Family and Social Services Service Package, Director of Child Welfare. A report from the head of child protection services is attached to the report.</p><p> The report states that there was a lack of clear guidelines for determining the background of support staff and that the forms contained errors. The City of Helsinki is updating the guidelines and renewing the forms. The old forms in use are attached to the report.</p><p> <strong>In the opinion of the controller, on which provision is the activity described above based?</strong></p><p> The applicant for child support has been asked for written consent for the Helsinki Social and Health Services Child Welfare Support Personnel to request any criminal and punitive entries concerning the applicant, as well as home alerts and arrests from the police authority.</p><p> It is in the best interests of the child that a person acting as a support person in accordance with section 28 of the Social Welfare Act does not have any previous entries in the police register, because the child is in a vulnerable position according to his or her age and level of development. Children covered by support person activities (Section 28 of the SHL) are children in need of special support (Section 3 of the SHL) or children in need of protection (Section 27 of the Child Welfare Act).</p><p> An adult acting as a support person in accordance with section 28 of the Social Welfare Act is in contact with a child with special needs and who is often traumatized. For this reason, it is particularly important for the city, as a responsible actor, to ensure that it is safe for the child to be with an adult volunteer trained for the task. The criminal record extract for a volunteer working with children does not provide enough comprehensive information, but adults with a background that is not reflected in the criminal record extract in question (eg domestic alerts due to intoxication and intimate partner violence) have been involved.</p><p> For these reasons, the processing of personal data received from the police in connection with criminal convictions and offenses is permitted under section 7 (1) (2) of the Data Protection Act, as the data are processed directly due to the statutory tasks referred to in section 6 (1) (2). Personal data obtained from the police other than criminal convictions or offenses are processed in accordance with Article 6 (1) (e) of the Data Protection Regulation for the performance of a task in the public interest and are necessary and proportionate for the performance of social and health tasks.</p><p> <strong>With which police department or representative has the controller agreed on the procedure described above.</strong></p><p> There is no agreement on the procedure with the police. The procedure is based on section 20 of the Social Welfare Clients Act: State and municipal authorities and other public bodies, Social Insurance Institution, Finnish Center for Pensions, pension fund and other pension institutions, insurance institutions, training providers, social service providers, at the request of the social welfare authority, free of charge and without prejudice to secrecy provisions, information and explanations that materially affect the social welfare client relationship and are necessary for the authority's statutory task (to determine the client's social welfare needs), to organize social welfare and to take related measures;</p><p> <strong>Is the data controller aware of what is provided for in the Act on Determining the Criminal Background of Volunteers Working with Children (148/2014)</strong></p><p> We are aware of the law in place. In our operations, Section 5 of the Act on Determining the Criminal Background of Volunteers Working with Children is fulfilled, ie an extract from the criminal record is requested from the Legal Register Center. In addition to this, we ask, with the consent of the person intending to be a support person, for other information about the applicant known to the police that is more detailed and necessary for the organization of social care.</p><p> <strong>Any relevant contract documents with the police and a model of the power of attorney to be used should be attached to the report.</strong></p><p> The municipality has no separate agreement on the matter. The information is requested as a support person with the written consent of the applicant. The forms in use are incorrect in content and we have disabled them. New forms are being prepared.</p><h5 id="OT4"> The registered counterparty</h5><p> The Office of the Data Protection Officer has requested a response from the data subject on the data controller's report, the response was received on 14 December 2020.</p><p> The City of Helsinki report states: "- the processing of personal data received from the police related to criminal convictions and violations is permitted on the basis of section 7 (1) (2) of the Data Protection Act, as the data are processed directly due to the statutory tasks referred to in section 6 (1) (2). than personal data obtained from the police in connection with criminal convictions or offenses are processed in accordance with Article 6 (1) (e) of the Data Protection Regulation for the performance of a task in the public interest and are necessary and proportionate for the performance of social and health tasks. "</p><p> On the other hand, the City of Helsinki's report emphasizes entries related to the applicant's criminal and violation background. On the other hand, the City of Helsinki has not made more specific time or topic limits to the personal information requested from the police about support personnel applicants. Criminal and punitive entries also cover criminal reports made by the person himself or herself, as well as sensitive personal data of the persons mentioned in these reports who are unknown to the City of Helsinki's support staff.</p><p> in accordance with the attached image (co. document photographed in the City of Helsinki support person in the office 09.24.2020, when I went to check the personal data processed about me) the police on me "markings on police information system" are meant three investigations reported, all of which I am the injured party. The City of Helsinki support staff member himself stated in a message sent on 28 August 2020 that the "matters mentioned in these [investigation] notices had nothing to do with acting as a support person". Nevertheless, he inquired if I would like to discuss these announcements further in his message of 27 August 2020.</p><p> This cannot be a proportionate processing of personal data. For example, at the Helsinki Mission in a similar voluntary support person operation for children who are challenging and covered by child protection support measures, only the criminal record is cleared from the voluntary support personnel.</p><p> In the interview situation, when I was applying for a support person, I was told that the power of attorney I had signed, which is also attached to the City of Helsinki report, seeks the applicant's criminal record and information about home alarms. According to an additional information request criminal reports, which I myself am the injured party, came to me, therefore, fully yllättyksenä and shock. I also did not receive copies of these police papers procured by the City of Helsinki's support staff when I asked for them, although I was able to take photos of them when I visited them on the spot to see them. documents.</p><h4 id="OT5"> Applicable provisions and assessment</h4><h5 id="OT6"> Application of the Act on the Processing of Personal Data of Volunteers Working with Children (148/2014)</h5><p> 1. Pursuant to Article 10 of Data Protection Regulation (EU) 2016/679, the processing of personal data relating to criminal convictions and infringements or related security measures pursuant to Article 6 (1) shall be carried out only under the supervision of an authority or authorized by Union law or national law providing for appropriate safeguards. to protect rights and freedoms. A comprehensive criminal record is kept only under the supervision of a public authority.</p><p> 2. Prior to the entry into force of the Data Protection Regulation, information concerning a criminal offense, punishment or other criminal sanction was provided as sensitive personal data on the basis of section 11 (1) (3) of the Personal Data Act (523/1999).</p><p> 3. The Data Protection Regulation is the directly applicable law in the Member States. However, Article 6 (2) of the Data Protection Regulation allows for more detailed provisions to adapt the provisions of the Regulation when the processing of personal data is necessary to comply with a legal obligation of the controller (Article 6 (1) (c)) or to perform a public interest task or exercise public authority (Article 6 (1)). (e)). Article 6 (3) of the Data Protection Regulation requires that the basis for the processing of personal data in such situations is laid down in Union law or in the law of the Member State applicable to the controller. Such legislation may include provisions on, inter alia, the type of data to be processed, the data subjects, the persons to whom and the purposes for which the personal data may be disclosed.</p><p> 4. In its opinion PeVL7 / 2019 vp), the Committee on Constitutional Affairs stated: According to the EU General Data Protection Regulation, special personal data which are particularly sensitive to fundamental rights and freedoms must also be protected with particular care, as the context in which they are processed could pose significant risks to fundamental rights and ... freedoms. As a result, the committee has paid special attention to the fact that the processing of sensitive data should be limited to what is necessary by precise and precise provisions (see, for example, PeVL 3/2017 vp., P. 5). In the committee's more recent practice, such a delimitation has been considered a matter of order of adjustment (see, for example, PeVL 15/2018 vp, p. 40). According to the Committee on Constitutional Affairs, the regulation of the processing of sensitive data, within the framework allowed by the Data Protection Regulation, should continue to be assessed also on the basis of the practice of legality of previous regulation. However, the need for more detailed legal regulation than the General Data Protection Regulation must also be justified on a case-by-case basis within the framework of the Data Protection Regulation. With regard to the need for regulation, attention should also be paid to the risk-based approach adopted in the regulation. The Committee emphasizes that clear and comprehensible legislation should also be sought with regard to the regulation of the processing of sensitive personal data (PeVL 14/2018 vp., Pp. 5-6).</p><p> 5. The processing of personal data to determine the criminal background of volunteers working with children is regulated by a special law. Pursuant to Section 2 of the Act on Determining the Criminal Background of Volunteers Working with Children, this Act provides for a procedure for determining the criminal background of volunteers working with minors.</p><p> 6. According to the preliminary works of the Act (HE 149/2013 vp 13), the aim of the proposal is to safeguard the child's personal integrity in voluntary activities and thus to promote and secure the child's growth, development and well-being. The aim is to contribute to safeguarding the fundamental and human rights of the child and to protect the child from sexual exploitation and exploitation, as well as from other serious violent crimes and incitement to drug use. At the same time, the aim is to respect the protection of the privacy and personal data of those involved in volunteering. The conditions for surrender of a criminal record must be acceptable and well-defined. According to the proposal, an extract could be requested by the organizer of the volunteer task with the consent of the volunteer. The operational objective of the legislation is to create a proportionate and appropriate procedure for both the organizers of voluntary activities and the Legal Register Center.</p><p> 7. Furthermore, according to the preliminary works of the law (PeVL 37/2013 vp), it is essential for the requirement of proportionality that the application for an extract from the criminal record requires the consent of the volunteer. In addition, information on only the offenses proposed to be listed in section 6 (2) of the Criminal Records Act that are relevant to the objectives of regulation shall be entered in the extract from the criminal record. Requesting an extract from the criminal record is also not the primary means of protecting the personal integrity of minors in voluntary activities, but the organizer of the voluntary task must first take the measures to ensure the integrity referred to in section 4 of the draft law. The applicant for a criminal record extract must notify the Legal Register Center of these actions. The organizer of the volunteer task may only make entries in the personal data of the volunteer about the verification of the extract and its identification data, and no copy of the extract may be taken. In addition, the bill contains provisions on confidentiality and the release of an extract from the criminal record immediately after the case has been dealt with to the volunteer concerned by the extract. There are no comments on the proposed regulation in terms of its proportionality.</p><p> 8. Under Article 4 of the Law on the criminal background of volunteers working with children, the organizer of a voluntary task must establish instructions or procedures concerning his activities which are necessary to achieve the purpose of that law and assess the voluntary tasks for which the voluntary background of selected volunteers is to be determined.</p><p> 9. According to the preamble to the above-mentioned law (LaV 16/2013 vp), the committee considers the extension of criminal background research to volunteering as an important additional means of protecting children from crimes endangering their safety. However, the deterrent effect of criminal background checks is limited, whether it is a voluntary or mandatory system. This is because the criminal record extract only shows the convictions of the person at the time of requesting the extract. In a situation where a person has not been convicted of a crime at the time of requesting an extract, for example because the crime has not been revealed or is still under investigation, there is no record of the crime in the extract from the criminal record. The information will also be deleted from the criminal record after a certain period of time has been given. An unmarked criminal record extract is also not a guarantee that a person will not commit such crimes in the future. It should also be noted that only a very small proportion of the extracts from the criminal record applied to the Center for Legal Registers contain a reference to the judgment (0.1%). Effective protection of the integrity of children therefore also requires means other than the establishment of a criminal record. In this regard, the Committee particularly welcomes the provision proposed in the draft that the organizer of voluntary activities must establish guidelines and procedures for the activities concerning the protection of the personal integrity of minors (Article 4 of the draft law). Such general and ongoing guidelines and procedures are more effective in determining the background of a crime to protect children. This obligation only applies to organizers of voluntary activities who intend to make use of the possibility to establish their criminal background.</p><p> 10. According to the data controller's report, the processing of personal data received from the police in connection with criminal convictions and offenses would be permitted under section 7 (1) (2) of the Data Protection Act, as the data are processed directly due to the statutory tasks referred to in section 6 (1). With regard to the statutory task, the registrar refers to section 28 of the Social Welfare Act (2014/1301), which provides for other social services as follows: a peer group activity may be organized for a child in need of special support or a support person or family to ensure the child's health or development.</p><p> 11. The registrar has introduced a procedure in which it requests information from the police on the possible criminal and punitive entries of a person seeking support for a child / young person on the basis of section 20 of the Act on the Status and Rights of Social Welfare Clients. However, instead of this procedure, the controller should take the measures prescribed in section 4 of the Act on the Determination of the Criminal Background of Volunteers Working with Children, as described above.</p><p> 12. In the light of the above, the determination of the criminal background and the related procedure of volunteers working with children is regulated by a special law, the controller cannot introduce regular parallel procedures on the basis of more general legislation and process criminal data more widely than the special law allows. Such a procedure would render irrelevant the special law enacted in the matter and would override the requirements of strictness, precision and proportionality arising from this law, as well as the other aspects raised above in connection with the preparation of the Parliamentary Law.</p><h5 id="OT7"> Application of the Act on the Status and Rights of Social Welfare Clients (812/2000)</h5><p> 13. According to the registrar's report, the investigation of the criminal background of volunteers working with children is fulfilled in its activities, ie an extract from the criminal record is requested from the Legal Register Center. In addition, with the consent of the person intending to act as a support person, the controller requests other information known to the police about the applicant that is more detailed and necessary for the organization of social care. According to the registrar's report, the police provide the registrar with copies of the notification of all the person's cases.</p><p> 14. The data subject has been asked for consent to retrieve police information. Consent has not been voluntary, as required by the Data Protection Regulation, as the controller has informed the data subject that he or she is not suitable for child and youth support staff because he or she has not consented to the disclosure of police data. Recital 43 of the Data Protection Regulation states: In order to ensure that consent is given voluntarily, consent should not be a valid legal basis for the processing of personal data in a specific situation where there is a clear discrepancy between the data subject and the controller. This applies in particular to a situation where the controller is a public authority and where it is therefore unlikely that consent has been given voluntarily in all the circumstances of that situation. Section 20 of the Act on the Status and Rights of Social Welfare Clients does not require the data subject's consent to obtain the information, but the basis for processing the information becomes the applicable special legislation. Consent cannot therefore be the basis for the processing of personal data in the present case. Consent could at most be considered a safeguard measure in accordance with section 6 (2) of the Data Protection Act.</p><p> 15. According to the registrar, obtaining information from the police is based on Chapter 4, Section 20 of the Act on the Status and Rights of Social Welfare Clients (812/2000), paragraph 1 of which states that the organizer, the social service provider, the health and medical care entity or business unit and the health care professional are obliged to provide the social care authority free of charge and without prejudice to secrecy provisions. for the organization of social welfare and the implementation of related measures, as well as for the verification of the information provided to the authority.</p><p> 16. Section 20 of the Act on the Status and Rights of Social Welfare Clients provides for the possibility of obtaining necessary information essentially related to the social welfare client relationship. According to section 3 (1) (2) of the Social Welfare Act (1301/2014), a social welfare client means a person who applies for or uses social welfare or who is the subject of it, regardless of his or her will. Thus, a person wishing to become a voluntary support person is not a social care client. Criminal information about a support person is not mentioned in the law or its preamble, and there are no special provisions other than the law on determining the criminal background of volunteers working with children. Section 20 of the Act on the Status and Rights of Social Welfare Clients makes it possible to obtain personal data only in individual cases where it has been deemed necessary on the basis of discretion.</p><p> 17. The controller has requested personal information from the police about a person who regularly applies for a child / young person support person with a form titled as a request for official assistance. The form asked for information about a person’s possible criminal and criminal records (e.g., home alerts, arrests). The form did not specify or limit what information the request concerns. When requesting information, it has not been assessed which information would be necessary for the data controller's statutory task.</p><p> 18. The need for information should be considered on a case-by-case basis. In the case in question, the controller has received investigation notices from the police in which the data subject is an interested party. The controller has started processing the notifications and asked the registrant to discuss them with the controller's representative. However, the controller's representative has subsequently stated that the matters mentioned in the notifications have nothing to do with acting as a support person. The personal data processed have therefore not been necessary or even necessary for the authority due to the statutory task.</p><p> 19. In view of the above, the controller has not had the right to obtain or process the personal data of the data subject in question. The controller has acted in a manner inconsistent with the above by creating a policy whereby the police regularly request and receive all police records of persons applying for voluntary child / youth support.</p><h5 id="OT8"> Planning and guidelines for the processing of personal data</h5><p> 20. According to the data controller's report, the forms used are incorrect in content and have been taken out of service. According to the report, there is a lack of clear guidelines on the processing of personal data in support personnel activities. The City of Helsinki has announced that it will update the guidelines and renew the forms in question. On the basis of the information received, the data subject has not been informed about the processing of personal data as provided for in Article 12 of the Data Protection Regulation.</p><p> 21. The procedure has been unclear, the data subject has been asked for consent to request information from the police. Consent has not been voluntary, as required by Article 6 (1) of the Data Protection Regulation, and its meaning in the context of a statutory right of access remains unclear.</p><h4 id="OT9"> Note and order of the Assistant Data Protection Supervisor</h4><p> <strong>I will issue a remark to the controller in accordance with Article 58 (2) (b) of the Data Protection Regulation, as the processing of the controller's personal data has infringed Articles 5, 6, 10, 12 and 25 of the Data Protection Regulation.</strong></p><p> <strong>Pursuant to Article 58 (2) (d) of the Data Protection Regulation, the controller shall order the processing of personal data in accordance with this Regulation within 30 days of notification of this Decision so that personal data are no longer processed in breach of Articles 5, 6, 10, 12 and 25.</strong></p><p> The processing of personal data in question is regulated by a specific law within the meaning of Article 10 of the Data Protection Regulation. In addition to this special provision, the controller has, in non-justified individual cases, introduced policies in which personal data are regularly processed more extensively than provided for in the special law. There have been no grounds for such processing within the meaning of Article 6 of the Data Protection Regulation. In so doing, the controller has processed personal data in breach of Articles 6 and 10 of the Data Protection Regulation (paragraphs 1 to 12 above).</p><p> The controller has not taken the technical and organizational measures required by Article 25 of the Data Protection Regulation to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed. The controller has not planned the processing of personal data in the manner referred to in Article 25 (1) of the Regulation and has defined the methods of processing personal data and has effectively implemented the data protection principles by implementing e.g. minimization of data and organizational measures so that processing complies with the requirements of the Data Protection Regulation and the rights of data subjects are protected (paragraphs 20 to 21 above). In so doing, the controller has processed personal data in breach of Article 25 of the Data Protection Regulation.</p><p> The data processed by the controller in criminal cases in which the controller is a party have not been necessary or even necessary for the purposes for which the controller processed them. Thus, in breach of the Data Protection Regulation and the specific provision described above, the controller has processed personal data which were not necessary or even necessary for the controller's duties. In so doing, the controller infringed Article 5 (1) (a) and (c) of the Data Protection Regulation (paragraphs 13 to 19 above).</p><p> The data subject has not been informed of the processing of personal data as required by Article 12 of the Data Protection Regulation (paragraphs 20 to 21 above).</p><h5 id="OT10"> Other measures</h5><p> This decision does not assess the activities of the police in relation to the processing of personal data, in particular the transfer of data. In accordance with the inspection plan of the Office of the Data Protection Officer (dnro 10253/164/20), the disclosure of personal data to the authorities in individual cases will be subject to an inspection of the Helsinki Police Department in 2021.</p><p> The decision will be sent to the Ministry of Social Affairs and Health for information for a possible assessment of the timeliness of the legislation, as the decision concerns the interpretation of section 20 of the Act on the Rights and Status of Social Welfare Clients.</p><p> The decision will also be sent to the Equality Ombudsman for information upon request.</p><p> The decision is not yet final.</p></div><!-- cached 22:34:22 10.02.2021 --></div></div><div id="sidebar"><div class="description"><h3 class="title material"> <a href="/fi/viranomaiset/tsv/">Data Protection Officer</a></h3><p> Decisions of the Data Protection Supervisor on the interpretation of the Data Protection Regulation and the Personal Data Act.</p></div><div id="document-sidebar"><div class="extra-links"><h3 class="other title"> Other material related to the material</h3><ul><li> <a href="/data/tsv/TSV_tyojarjestys_FI.pdf" class="pdf"><span>›</span> Rules of procedure of the Office of the Data Protection Officer</a></li></ul></div></div><div id="toc-container"><div id="toc-title"><h4> Table of contents</h4><h3> 1/15/2020</h3></div><div id="toc-content"><div id="toc"> <a href="#">Criminal background associated with establishing the processing of personal data in connection with child support person</a> <a href="#OT1">CASE</a> <a href="#OT2">statement obtained from the data</a> <a href="#OT3">report from the Registrar</a> <a href="#OT4">of a registered equivalent</a> <a href="#OT5">provisions applicable and appropriate evaluation</a> <a href="#OT6">processing of personal data Act of volunteers working with children Criminal Background of Persons (148/2014) Application of</a> <a href="#OT7">the Act on the Status and Rights of Social Welfare Clients (812/2000) application</a> <a href="#OT8">Planning and instructions for the processing</a> <a href="#OT7">of</a> <a href="#OT8">personal data</a> <a href="#OT9">Note and order of the Assistant</a> <a href="#OT8">Data Protection</a> <a href="#OT9">Supervisor</a> <a href="#OT10">Other measures</a></div></div><div id="toc-footer"> <a class="to-top" href="#document">To the beginning of the page</a></div></div></div></div><div id="breadcrumbs-bottom"><div class="container"> <span class="skip">You are here:</span> <a class="home" href="/fi/">Finlex</a> › <a href="/fi/viranomaiset/">Authorities</a> › <a href="/fi/viranomaiset/tsv/">Data Protection Commissioner</a> › <a href="../2020/" title="Data Protection Supervisor 2020">2020</a> › <span title="Data Protection Supervisor 15.1.2020">15.1.2020</span> </div></div><div id="sitemap"><div id="sitemap-content" class="container"><div id="sitemap-category-laki"><h5> <a href="/fi/laki/">Legislation</a></h5><ul><li> <a href="/fi/laki/ajantasa/">Up - to - date legislation</a></li><li> <a href="/fi/laki/alkup/">Acts in original</a></li><li> <a href="/fi/laki/kokoelma/">Electronic collection of legal acts</a></li><li> <a href="/fi/laki/smur/">Directory of legislative amendments</a></li><li> <a href="/fi/laki/kaannokset/">Translations of legal acts</a></li><li> <a href="/fi/laki/saame/">Acts in the Sámi language</a></li></ul></div><div id="sitemap-category-oikeus"><h5> <a href="/fi/oikeus/">Case law</a></h5><ul><li> <a href="/fi/oikeus/kko/">The Supreme Court</a></li><li> <a href="/fi/oikeus/kho/">The Supreme Administrative Court</a></li><li> <a href="/fi/oikeus/ho/">Rights of the Court</a></li><li> <a href="/fi/oikeus/hao/">Administrative rights</a></li><li> <a href="/fi/oikeus/mao/">Market law</a></li><li> <a href="/fi/oikeus/tt/">Industrial tribunal</a></li><li> <a href="/fi/oikeus/vako/">Insurance law</a></li><li> <a href="/fi/oikeus/eurooppa/">European courts</a></li><li> <a href="/fi/oikeus/foki/">Case law in the literature</a></li></ul></div><div id="sitemap-category-viranomaiset"><h5> <a href="/fi/viranomaiset/">Authorities</a></h5><ul><li> <a href="/fi/viranomaiset/normi/">Collections of regulations of public authorities</a></li><li> <a href="/fi/viranomaiset/tyoehto/">Collective agreements</a></li><li> <a href="/fi/viranomaiset/foka/">Chancellor of Justice of the Government</a></li><li> <a href="/fi/viranomaiset/ftie/">Data Protection Board</a></li><li> <a href="/fi/viranomaiset/tsv/">Data Protection Officer</a></li></ul></div><div id="sitemap-category-sopimukset"><h5> <a href="/fi/sopimukset/">Government contracts</a></h5><ul><li> <a href="/fi/sopimukset/sopsteksti/">Government contracts</a></li><li> <a href="/fi/sopimukset/sopsviite/">Government Contracts Reference Database</a></li><li> <a href="/fi/sopimukset/sopimussarja/">Electronic contract series</a></li><li><a href="/fi/sopimukset/verosopimusteksti/">
                      </a></li></ul></div><div id="sitemap-category-esitykset"><h5><a href="/fi/esitykset/">Government proposals</a></h5><ul><li> <a href="/fi/esitykset/he/">Government proposals</a></li></ul><h5> <a href="http://julkaisut.finlex.fi">Proceedings</a></h5><ul><li> <a href="http://lainvalmistelu.finlex.fi">Legislative Process Guide</a></li><li> <a href="http://helo.finlex.fi">Instructions for preparing Board proposals</a></li><li> <a href="http://lainkirjoittaja.finlex.fi">The Writer's Guide</a></li><li> <a href="http://yhdenvertaisuus.finlex.fi">Equality assessment</a></li><li> <a href="http://kuulemisopas.finlex.fi">Legislative Consultation Guide</a></li><li> <a href="http://kokeiluohje.finlex.fi">Trial Law Guide</a></li></ul></div><div id="sitemap-category-finlex"><h5> <a href="/fi/">Finlex®</a></h5><ul><li> <a href="/fi/uutiset/">News archive</a></li><li> <a href="/fi/rss/">RSS feeds</a></li><li> <a href="/fi/ohjeet/">Instructions</a></li><li> <a href="/fi/palaute/">Feedback</a></li><li> <a href="/fi/kayttoehdot/">Terms of use</a></li><li> <a href="/fi/saavutettavuusseloste/">Accessibility statement</a></li><li> <a href="/fi/sivukartta/">Sitemap</a></li></ul></div></div><div id="disclaimer"><p> Finlex ® is a public and free Internet service for legal material owned by the Ministry of Justice.<br /> Finlex content is produced and maintained by Edita Publishing Oy. Neither the Ministry of Justice nor Edita shall be liable for any errors that may occur in the content of the databases, direct or indirect damages caused to the user by their use, or interruptions in the use of the Internet data network or other disturbances.</p></div></div></body></html>
@@ Line 62: / Line 62: @@
 ===Facts===
-Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject gave consent to the data controller to obtain criminal  and controller has systematically requested records regarding the applicant's
+Data subject has requested the Finnish Data Protection Ombudsman's opinion on the lawfulness of the processing of their personal data by the City of Helsinki's Social services and healthcare division. As a part of an application process to volunteer as a support person for children and youth, the data subject has given consent to the data controller to obtain the applicant's criminal records.
 ===Dispute===